Close entry points, contain lateral movement, detect the activity that precedes encryption and keep recoverable backups, based on CISA and NIST guidance.
Preventing ransomware relies on three lines of defence: closing the usual entry points, detecting the attacker during the phase that precedes encryption, and being able to restore operations from backups the attacker could not reach. No single tool covers all three. Guidance from CISA and NIST, including the NIST IR 8374 Revision 1 profile finalised in June 2026, provides a structured basis for building these defences.
Modern ransomware is rarely a single malicious file. It is usually an operation conducted by human operators over days or weeks. After initial access, they establish persistence, escalate privileges, map the network, disable security tools, delete or encrypt backups, and often steal data before launching encryption across as many systems as possible. Data theft enables double extortion: even with good backups, the victim is threatened with publication of stolen information.
This sequence matters for defenders, because each stage before encryption is an opportunity to detect and stop the attack.
CISA's #StopRansomware Guide, updated in 2023 jointly with the FBI, NSA and MS-ISAC, identifies the most common initial access vectors: vulnerabilities and misconfigurations on internet-facing systems, compromised credentials, phishing, precursor malware infections, and access through third parties and managed service providers. The corresponding controls are well known, but they must be applied consistently:
When prevention fails, architecture determines how far the attack spreads. Network segmentation isolates critical zones and slows lateral movement. Tiered administration keeps domain administrator credentials off ordinary workstations and servers. The principle of least privilege reduces what a stolen account can do. Hardening Active Directory, the target of most ransomware operators, deserves particular attention: monitor privileged group membership, protect domain controllers, and disable legacy protocols where possible.
Detection efforts should focus on the preparatory activity that precedes encryption. Typical signals include:
Endpoint detection and response tools, a SIEM that correlates events from endpoints, firewalls and identity systems, and an analyst team able to act quickly form the core of this capability. Mapping detection rules to the MITRE ATT&CK framework helps identify gaps.
Backups are the last line of defence and a priority target for attackers. CISA recommends offline, encrypted backups of critical data, with regular testing of their availability and integrity in a recovery scenario. In practice this means:
An incident response plan specific to ransomware should define who decides on isolation, how systems are disconnected, how management, regulators and partners are informed, and how the organisation communicates. The CISA guide includes a response checklist covering detection and analysis, containment and eradication, and recovery. Exercises built on realistic scenarios reveal weaknesses in both technical procedures and decision chains. For organisations subject to regulations such as NIS 2 or DORA, notification obligations and deadlines must be built into the plan.
Ransomware defence combines hardening, detection and incident management. Security operations teams can strengthen their detection skills with the Certified SOC Analyst (C|SA) training. Incident responders will find a structured method in the E|CIH Certified Incident Handler training. Managers who need to organise the incident management process can follow the PECB ISO/IEC 27035 Lead Incident Manager training.
Ransomware is a business risk as much as a technical one. Reduce the entry points, contain lateral movement, watch for the signs that precede encryption, and make sure backups survive an attack and can actually be restored. Then test the whole chain regularly, because a plan that has never been exercised rarely works as expected on the day it is needed.